🕵️ RESEARCH & DEEP DIVES
CVE-2026-76977: Clickjacking flaw in SAPUI5 Frame Options Allowlist bypasses framing checks
SAP UI5 fails to validate the parent frame's origin against its allowlist, enabling clickjacking attacks against authenticated users.- Affects SAPUI5 Frame Options Allowlist in SAP_UI versions 750, 754, 755, 756, 757, 758, 816 and UI_700 200.
- SAP UI5 does not sufficiently validate the parent frame's origin against the configured allowlist, allowing framing restrictions to be bypassed.
- An unauthenticated attacker hosts a malicious page; if an authenticated victim visits and interacts with it, they can be tricked into unintended actions.
- CWE-1289 improper input validation; CVSS 4.3 medium (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), low integrity impact only.
- Tracked as CVE-2026-76977, assigned by SAP, published 2026-09-08; remediated via SAP Note 3783189 on SAP Security Patch Day.
Critical SAP GUI for Java Flaw (CVE-2026-66768, CVSS 9.0) Allows Command Execution
A critical flaw in SAP GUI for Java lets a low-privileged attacker execute arbitrary commands on victims' machines.- Affects SAP NetWeaver (SAP GUI for Java), component BC-FES-JAV 8.10
- SAP GUI for Java fails to enforce trust level policy for functions invoked from a connected backend (CWE-807), tracked as CVE-2026-66768 with CVSS 9.0
- An attacker with low privileges who can manipulate a connected backend system can trigger affected functionality with user interaction, leading to arbitrary command execution on the client machine
- Successful exploitation has high impact on confidentiality, integrity, and availability; no known exploitation in the wild reported
- Tracked under SAP Note 3781729 from the SAP Security Patch Day advisory
SAP Process Integration SOAP Adapter DoS flaw CVE-2026-58234 disclosed (CVSS 2.2)
SAP disclosed a low-severity denial-of-service vulnerability (CVE-2026-58234) in the SOAP Adapter of SAP Process Integration.- Affects SAP Process Integration (SOAP Adapter), SAP_XIAF version 7.50, tracked as CVE-2026-58234 (CWE-776, XML Entity Expansion)
- A privileged user can send crafted requests with deeply nested entity definitions, temporarily increasing processor load and degrading responsiveness
- Impact is limited to availability (low); no effect on confidentiality or integrity; CVSS 3.1 score 2.2 (AV:N/AC:H/PR:H/UI:N)
- No known exploits in the wild; remediation guidance is via SAP Note 3736494
CVE-2026-44766: SQL injection flaw in SAP S/4HANA Intercompany Matching and Reconciliation
SAP has patched an SQL injection vulnerability in S/4HANA's Intercompany Matching and Reconciliation component disclosed on August 2026 Patch Day.- Applies to SAP S/4HANA (Intercompany Matching and Reconciliation): S4CORE versions 104 through 109 and SAPSCORE 136 are affected (CVE-2026-44766).
- A low-privileged authenticated user can inject malicious input into certain functions that the database processes without proper validation.
- Impact is high on confidentiality (sensitive data access), with no impact on integrity or availability; CVSS 6.5 medium.
- The flaw was fixed via SAP Security Note 3756450 released as part of SAP Security Patch Day, August 2026.
knowns before 0.30.0 authorization bypass (CVE-2026-86544) lets read-only users escalate privileges
knowns versions before 0.30.0 contain an authorization bypass where mutating code actions are misclassified as read-only, allowing privilege escalation.- Affects the knowns project in all versions before 0.30.0; tracked as CVE-2026-86544 with CVSS 8.1 (High).
- Mutating code actions are incorrectly classified as read-only by ActionRegistry, which falls back to CapRead and is gated as such by the Guard middleware.
- Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
- Fixed in v0.30.0 via commit a2c98fc5; reported by Tong Hoang Gia and Nguyen Huy Hoang (GHSA-w323-3wpx-f7g5).
🕵️ RESEARCH & DEEP DIVES (One-liners)
Terminal escape sequence injection in mix usage_rules.search_docs via package... — CVE ThreatInt
Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence... — CVE ThreatInt
Credential disclosure in multitenant applications using SAP Cloud Application... — CVE ThreatInt
Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communic... — CVE ThreatInt
Insecure Deserialization in SAP NetWeaver Business ClientSAP NetWeaver Busine... — CVE ThreatInt
Missing Authorization Check in Application Server ABAP of SAP NetWeaver and A... — CVE ThreatInt
Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)SAP S/4HAN... — CVE ThreatInt
Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for A... — CVE ThreatInt
XML External Entity (XXE) Vulnerability in SAP Integration SuiteSAP Integrati... — CVE ThreatInt
Missing Authentication check in SAP NetWeaver (Message Server)SAP NetWeaver M... — CVE ThreatInt
Memory Corruption vulnerability in SAP Extended Passport (EPP) ProcessingA me... — CVE ThreatInt
knowns before 0.30.0 Unauthenticated Management API Exposureknowns versions b... — CVE ThreatInt
SAP CDS MTXS Critical Unauthenticated Credential Disclosure (CVE-2026-76969) — thehackerwire.com (discovered)
📋 ADVISORIES
📄 Source for SANS Stormcast Sep 8, 2026: Numbat AI observability; MikroTik and Magento 0-days exploited — isc.sans.edu
📄 Source for Critical memory corruption flaws in SAP NetWeaver AS ABAP patched in August 2026 Security Patch Day — me.sap.com